---
id: CVE-2026-110098
title: >-
  Jorani before 1.0.4 contains an insecure direct object reference vulnerability
  that allows authenticated users to modify, delete, and view other employees'
  requests by authorizing by operation name only
summary: >-
  Jorani before 1.0.4 contains an insecure direct object reference vulnerability
  that allows authenticated users to modify, delete, and view other employees'
  requests by authorizing by operation name only. Attackers can supply numeric
  requ…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:33.410'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110098'
references:
  - url: >-
      https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Extra.php#L151-L168
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Leaves.php#L276-L298
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jorani/jorani/commit/59c403224401824489ec662934f71c90d27f614c
    label: disclosure@vulncheck.com
  - url: 'https://github.com/jorani/jorani/issues/426'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/jorani/jorani/releases/tag/v1.0.4'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/jorani-before-1.0.4-insecure-direct-object-reference-in-leave-and-overtime-requests
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.183Z'
---

## Overview

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.